PT-2022-17895

Name of the Vulnerable Software and Affected Versions Veritas InfoScale Operations Manager versions prior to 7.4.2 Patch 600 Veritas InfoScale Operations Manager versions 8.x prior to 8.0.0 Patch 100 Description A reflected cross-site scripting XSS issue allows authenticated remote administrators...

PT-2022-17896

Name of the Vulnerable Software and Affected Versions Veritas InfoScale Operations Manager versions prior to 7.4.2 Patch 600 Veritas InfoScale Operations Manager versions 8.x prior to 8.0.0 Patch 100 Description The web server in Veritas InfoScale Operations Manager fails to sanitize input data f...

CVE-2022-26484: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in Veritas InfoScale Operations Manager VIOM before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100. The web server fails to sanitize admin/cgi-bin/rulemgr.pl/getfile/ input data, allowing a remote authenticated administrator to read arbitrary files on the system via...

CVE-2022-26483: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Veritas InfoScale Operations Manager VIOM before 7.4.2 Patch 600 and 8.x before 8.0.0 Patch 100. A reflected cross-site scripting XSS vulnerability in admin/cgi-bin/listdir.pl allows authenticated remote administrators to inject arbitrary web script or HTML into an HTTP...

CVE-2021-45420

Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logoextraupload.cgi, /cgi-bin/calsave.cgi, and /cgi-bin/loutils.cgi. An attacker will be able to write any file on the target system without any kind of authentication mechanism, and this can lead to...

CVE-2021-45420: Exposure of Sensitive Information to an Unauthorized Actor

Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logoextraupload.cgi, /cgi-bin/calsave.cgi, and /cgi-bin/loutils.cgi. An attacker will be able to write any file on the target system without any kind of authentication mechanism, and this can lead to...

PT-2022-2440

Name of the Vulnerable Software and Affected Versions D-Link DIR-825AC G1 affected versions not specified Description The issue is related to the incorrect handling of the cmd parameter in the cgi-bin/webupg component of the D-Link DIR-825AC G1 router's firmware. This can allow an attacker to...

Netgear RAX43 Buffer Overflow Vulnerability

The Netgear RAX43 is a router from the American company Netgear. A hardware device that connects two or more networks and acts as a gateway between them. A buffer overflow vulnerability exists in Netgear RAX43 version 1.0.3.96. The vulnerability is caused by the URL parsing functionality of the...

CVE-2021-20166

Netgear RAX43 version 1.0.3.96 contains a buffer overrun vulnerability. The URL parsing functionality in the cgi-bin endpoint of the router containers a buffer overrun issue that can redirection control flow of the applicaiton...

CVE-2021-20166

Netgear RAX43 version 1.0.3.96 contains a buffer overrun vulnerability. The URL parsing functionality in the cgi-bin endpoint of the router containers a buffer overrun issue that can redirection control flow of the applicaiton...

Buffer overflow

Netgear RAX43 version 1.0.3.96 contains a buffer overrun vulnerability. The URL parsing functionality in the cgi-bin endpoint of the router containers a buffer overrun issue that can redirection control flow of the applicaiton...

CVE-2021-20166

Netgear RAX43 version 1.0.3.96 contains a buffer overrun vulnerability. The URL parsing functionality in the cgi-bin endpoint of the router containers a buffer overrun issue that can redirection control flow of the applicaiton...

CVE-2021-20166

Netgear RAX43 firmware 1.0.3.96 is affected by a buffer overrun in the cgi-bin URL parsing endpoint (CVE-2021-20166). Nuclei templates also describe a related issue: command injection/authentication bypass in readycloud_control.cgi’s name parameter, and note that this vulnerability combines CVE-2...

PT-2021-6274

Name of the Vulnerable Software and Affected Versions Netgear RAX43 version 1.0.3.96 Description The issue is caused by a buffer overrun vulnerability in the URL parsing functionality of the cgi-bin endpoint. This can allow a remote attacker to impact the confidentiality, integrity, and...

CVE-2021-20166: Buffer Copy without Checking Size of Input

Netgear RAX43 version 1.0.3.96 contains a buffer overrun vulnerability. The URL parsing functionality in the cgi-bin endpoint of the router containers a buffer overrun issue that can redirection control flow of the applicaiton...

Netgear RAX43 缓冲区错误漏洞

The Netgear RAX43 is a router from the American company Netgear. A hardware device that connects two or more networks and acts as a gateway between them. A buffer overflow vulnerability exists in Netgear RAX43 version 1.0.3.96. The vulnerability is caused by the URL parsing functionality of the...

The vulnerability of the cgi-bin/upload_firmware.cgi component of the D–Link DIR-823G router’s microprogramming system allows a hacker to cause a service failure.

The vulnerability of the cgi-bin/uploadfirmware.cgi component of the D–Link DIR-823G router’s microprogramming system is related to the lack of authentication. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2021-13794

Name of the Vulnerable Software and Affected Versions: Gryphon Tower router affected versions not specified Description: A reflected cross-site scripting issue exists in the url parameter of the "/cgi-bin/luci/site access/" page on the Gryphon Tower router's web interface. An attacker could explo...

CVE-2021-20137: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting vulnerability exists in the url parameter of the /cgi-bin/luci/siteaccess/ page on the Gryphon Tower router's web interface. An attacker could exploit this issue by tricking a user into following a specially crafted link, granting the attacker javascript execution...

Gryphon Tower 跨站脚本漏洞

A cross-site scripting vulnerability exists in Gryphon Tower, a wireless router from Gryphon. The vulnerability stems from a lack of user-supplied data and output data validation filtering in the url parameter of cgi-bin/luci/siteaccess/, which can be exploited to execute client-side JavaScript...